Jump to content
xmonke

Please help identify mysterious program on my computer

Recommended Posts

I noticed a program listed in my uninstall list named "Installer" by "Default Company Name." When I begin to uninstall it, it asks me for admin permissions to C:\Windows\Installer\2ef2c531.msi in order to continue the uninstallation, but I'm afraid to do that, because I don't know what it is. There is no location listed for the program. In the registry, it's listed as being in my System32 folder, but I don't see it when I search the folder. My Malwarebytes scan of the folder found nothing malicious.

installer.png.b2b31a38e4983fe7316a0e86575ae41f.png

Does anyone know what this could be?

installer1.thumb.png.49a2858623ed49cb48c862e63e682db1.png

 

 

 

FRST.txt Addition.txt

scan_report_8.1.2020.txt

Share this post


Link to post
Share on other sites

Hello @xmonke

Please locate the file and upload it to https://virustotal.com and let them scan the file for any type of known malware threats. You can copy and paste that into the file upload and VirusTotal will scan it.

Then post back the link to the VirusTotal scan results.

C:\Windows\Installer\2ef2c531.msi

 

I would also recommend you double-check and see if any of these files exist and if so upload them to Virus Total as well

S1 agphtvms; \??\C:\Windows\system32\drivers\agphtvms.sys [X]
S1 amgkrgcm; \??\C:\Windows\system32\drivers\amgkrgcm.sys [X]
S1 bboujlqw; \??\C:\Windows\system32\drivers\bboujlqw.sys [X]
S1 cfdbcubc; \??\C:\Windows\system32\drivers\cfdbcubc.sys [X]
S1 cwnoyyaj; \??\C:\Windows\system32\drivers\cwnoyyaj.sys [X]
S1 dfvwoskw; \??\C:\Windows\system32\drivers\dfvwoskw.sys [X]
S1 edoxkxnz; \??\C:\Windows\system32\drivers\edoxkxnz.sys [X]
S1 emvhlncj; \??\C:\Windows\system32\drivers\emvhlncj.sys [X]
S1 fbtovpos; \??\C:\Windows\system32\drivers\fbtovpos.sys [X]
S1 fgoixrjh; \??\C:\Windows\system32\drivers\fgoixrjh.sys [X]
S1 fpztlmmu; \??\C:\Windows\system32\drivers\fpztlmmu.sys [X]
S1 fteeuspc; \??\C:\Windows\system32\drivers\fteeuspc.sys [X]
S1 gqspqtfw; \??\C:\Windows\system32\drivers\gqspqtfw.sys [X]
S1 gywiplsk; \??\C:\Windows\system32\drivers\gywiplsk.sys [X]
S1 gzcghjsy; \??\C:\Windows\system32\drivers\gzcghjsy.sys [X]
S1 haodbdwj; \??\C:\Windows\system32\drivers\haodbdwj.sys [X]
S1 hnmiodui; \??\C:\Windows\system32\drivers\hnmiodui.sys [X]
S1 hpbsjnrr; \??\C:\Windows\system32\drivers\hpbsjnrr.sys [X]
S1 ibjlajkn; \??\C:\Windows\system32\drivers\ibjlajkn.sys [X]
S1 kldphhnf; \??\C:\Windows\system32\drivers\kldphhnf.sys [X]
S1 kqkpoiei; \??\C:\Windows\system32\drivers\kqkpoiei.sys [X]
S1 krymzvmt; \??\C:\Windows\system32\drivers\krymzvmt.sys [X]
S1 lwinoeda; \??\C:\Windows\system32\drivers\lwinoeda.sys [X]
S1 ohuzirms; \??\C:\Windows\system32\drivers\ohuzirms.sys [X]
S1 paxnqiwb; \??\C:\Windows\system32\drivers\paxnqiwb.sys [X]
S1 qbxqiovf; \??\C:\Windows\system32\drivers\qbxqiovf.sys [X]
S1 rfjcyner; \??\C:\Windows\system32\drivers\rfjcyner.sys [X]
S1 rlvpbrzy; \??\C:\Windows\system32\drivers\rlvpbrzy.sys [X]
S1 rmsghjff; \??\C:\Windows\system32\drivers\rmsghjff.sys [X]
S1 sijvldjc; \??\C:\Windows\system32\drivers\sijvldjc.sys [X]
S1 sqfiicrf; \??\C:\Windows\system32\drivers\sqfiicrf.sys [X]
S1 tnlsvnju; \??\C:\Windows\system32\drivers\tnlsvnju.sys [X]
S1 ubzebrsz; \??\C:\Windows\system32\drivers\ubzebrsz.sys [X]
S1 udqbfrll; \??\C:\Windows\system32\drivers\udqbfrll.sys [X]
S1 ufeenxpr; \??\C:\Windows\system32\drivers\ufeenxpr.sys [X]
S1 umglkozq; \??\C:\Windows\system32\drivers\umglkozq.sys [X]
S1 uxvbvzdc; \??\C:\Windows\system32\drivers\uxvbvzdc.sys [X]
S1 wgyrgjqy; \??\C:\Windows\system32\drivers\wgyrgjqy.sys [X]
S1 wuvyitqf; \??\C:\Windows\system32\drivers\wuvyitqf.sys [X]
S1 xbevxrnh; \??\C:\Windows\system32\drivers\xbevxrnh.sys [X]
S1 xmolgcen; \??\C:\Windows\system32\drivers\xmolgcen.sys [X]
S1 xvmmkfsh; \??\C:\Windows\system32\drivers\xvmmkfsh.sys [X]
S1 ycxvshyj; \??\C:\Windows\system32\drivers\ycxvshyj.sys [X]
S1 ynozmqhi; \??\C:\Windows\system32\drivers\ynozmqhi.sys [X]
S1 ytqujthg; \??\C:\Windows\system32\drivers\ytqujthg.sys [X]
S1 yvpsypjn; \??\C:\Windows\system32\drivers\yvpsypjn.sys [X]
S1 zgcfcoty; \??\C:\Windows\system32\drivers\zgcfcoty.sys [X]
S1 zplbfaoq; \??\C:\Windows\system32\drivers\zplbfaoq.sys [X]

 

All of this appears to be due to someone attempting to steal software. I would highly recommend whomever is using the computer in this manner consider changing their behavior so as to better protect the computer.

 

Share this post


Link to post
Share on other sites

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

  • It will start a download of "esetonlinescanner.exe"
  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get it started. 
  • When presented with the initial ESET options, click on "Computer Scan".
  • Next, when prompted by Windows, allow it to start by clicking Yes 
  • When prompted for scan type, Click on Full scan 
  • Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
  • Have patience.  The entire process may take an hour or more. There is an initial update download.
  • There is a progress window display.
  • You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
  • When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
  • Click The blue “Save scan log” to save the log.
  • If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
  • Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

 

Share this post


Link to post
Share on other sites

Hello,

VirusTotal did not find anything and I do not have any of those drivers. Also, I wasn't able to save the log file, but ESET did not find anything either.

Share this post


Link to post
Share on other sites

Okay, unless you want to scan with any other scanners it looks like you should be okay.

Is there anything else we can assist you with?

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.